To: 


Of: 


ICO. 


Information Commissioner’s Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


CPS Advisory Limited 


43 Brynymor Road, Gowerton, Swansea, United Kingdom, SA4 3EY 


The Information Commissioner (“Commissioner”) has decided to issue 
CPS Advisory Limited (“CPSAL”) with a monetary penalty under section 
55A of the Data Protection Act 1998 (“DPA”). The penalty is being 
issued because of a serious contravention of regulation 21B of the 
Privacy and Electronic Communications (EC Directive) Regulations 
2003. 


This notice explains the Commissioner's decision. 


Legal framework 


CPSAL, whose registered office address is given above (Companies 
House Registration Number: 10683273) is the organisation stated in 
this notice to have used a public electronic communications service to 
make unsolicited calls for the purposes of direct marketing in relation 
to occupational pension schemes or personal pension schemes contrary 
to regulation 21B of PECR. 
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4. Regulation 21B paragraph (1) of PECR provides that: 


“(1) A person must not use, or instigate the use of, a public electronic 


communications service to make unsolicited calls to an individual 


for the purpose of direct marketing in relation to occupational 


pension schemes or personal pension schemes, except where 


paragraph (2) or (3) applies.” 


5: Regulation 21B paragraphs (2), (3), and (4) provide that: 


“(2) This paragraph applies where— 


(a) 


(b) 


the caller is an authorised person or a person who is the 
trustee or manager of an occupational pension scheme or a 


personal pension scheme; and 


the called line is that of an individual who has previously 
notified the caller that for the time being the individual 
consents to such calls being made by the caller on that 


line. 


(3) This paragraph applies where— 


(a) 


(b) 


the caller is an authorised person or a person who is the 
trustee or manager of an occupational pension scheme or a 


personal pension scheme; 


the recipient of the call has an existing client relationship 
with the caller on the line and the relationship is such that 
the recipient might reasonably envisage receiving 
unsolicited calls for the purpose of direct marketing in 
relation to occupational pension schemes or personal 


pension schemes; and 


(c) 


© 
1C O. 
Information Commissioner's Office 
the recipient of the call has been given a simple means of 
refusing (free of charge except for the costs of the 
transmission of the refusal) the use of the recipient’s 
contact details for the purpose of such direct marketing, at 
the time that the details were initially collected and, where 


the recipient did not initially refuse the use of the details, 


at the time of each subsequent communication. 


(4) A subscriber must not permit the subscriber’s line to be used in 


contravention of paragraph (1)”. 


6. Regulation 21B paragraph 5 materially states that: 


“(5) In this regulation— 


(a) 


(b) 


“authorised person” has the meaning given in section 31 of 
the Financial Services and Markets Act 2000; 


“direct marketing in relation to occupational pension 


schemes or personal pension schemes” includes— 


(i) | the marketing of a product or service to be 
acquired using funds held, or previously held, 
in an occupational pension scheme or a 


personal pension scheme, 


(ii) the offer of any advice or other service that 
promotes, or promotes the consideration of, 
the withdrawal or transfer of funds from an 
occupational pension scheme or a personal 


pension scheme, and 


(iii) the offer of any advice or other service to 


enable the assessment of the performance of 
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an occupational pension scheme or a personal 


pension scheme (including its performance in 


comparison with other forms of investment); 


(c) “existing client relationship” does not include a relationship 
established at the instigation of the caller primarily for the 


purpose of avoiding the restriction in paragraph (1); and 


(d) “occupational pension scheme” and “personal pension 
scheme” have the meanings given in section 1(1) of the 
Pension Schemes Act 1993.” 


Under section 55A (1) of the DPA (as amended by PECR 2011 and the 
Privacy and Electronic Communications (Amendment) Regulations 
2015) the Commissioner may serve a person with a monetary penalty 


notice if the Commissioner is satisfied that — 

“(a) there has been a serious contravention of the requirements of the 
Privacy and Electronic Communications (EC Directive) Regulations 
2003 by the person, and 

(b) subsection (2) or (3) applies. 

(2) This subsection applies if the contravention was deliberate. 


(3) This subsection applies if the person - 


(a) knew or ought to have known that there was a risk that 


the contravention would occur, but 


(b) failed to take reasonable steps to prevent the 


contravention.” 
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The Commissioner has issued statutory guidance under section 55C (1) 
of the DPA about the issuing of monetary penalties that has been 
published on the ICO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


PECR implemented European legislation (Directive 2002/58/EC) aimed 
at the protection of the individual’s fundamental right to privacy in the 
electronic communications sector. PECR were amended for the purpose 
of giving effect to Directive 2009/136/EC which amended and 
strengthened the 2002 provisions. The Commissioner approaches the 


PECR regulations so as to give effect to the Directives. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the Data Protection Act 2018 (see 
paragraph 58(1) of Part 9, Schedule 20 of that Act). 


Background to the case 


CPS Advisory Limited first came to the attention of the Commissioner 
following a report from Aviva relating to an unsolicited live pension call 


from a specific Calling Line Identity (“CLI”). 


The Commissioner, through enquiries with the relevant 
Communications Service Provider (“CSP”), was able to establish that 
the CLI in question was one of a number shown as being allocated to 


an organisation called JMR Financial Limited. 


13. 


14. 


15. 


16. 


17. 


18. 
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Subsequent correspondence with the director of JMR Financial Limited 


revealed that the marketing calls being made were actually being made 


by a separate company for whom he was also a director: CPSAL. 


This information was verified with the CSP who confirmed that the 
account holder for the CLIs previously provided was indeed CPSAL, and 


not JMR Financial Limited as first thought. 


Having identified a number of complaints related to calls from those 
CLIs, the Commissioner sent an initial investigation letter to CPSAL on 
23 May 2019, setting out her concerns with the organisation’s 
compliance with PECR, and requesting information which would assist 
in her investigation. It is noted that this initial correspondence advised 
CPSAL that the Commissioner was investigating potential 


contraventions of regulation 21 PECR. 


CSPAL provided within its response details of the sole trading name 
used in its marketing calls: ‘The Advisory Network’. It also confirmed 
that the data used for its calls was purchased from third party data 
providers. In response to the Commissioner’s request for evidence of 
consent for the complaints received, CPSAL stated that “it is highly 
likely that these records have consented to receiving calls from us” but 


was unable to provide evidence of the specific consent. 


Open source research was conducted by the Commissioner on the 
websites from which CPSAL advised the consents would have been 
obtained from. On each of the three sites checked it was apparent that 
the means by which consent was obtained did not allow for it to be 


freely given, specific, or informed. 


The complaints received by the Commissioner relating to CLIs allocated 
to CPSAL include: 
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e “They were cold calling me about pensions. I told them it was 
illegal now.” 


e [Complainant confirmed call concerned pensions] “They told me 
they'd got my information from a data source, probably from a 
survey I'd completed. I do not recall completing a survey.” 


e “Man provided me with a website address when I asked him who 
the company was and where they got my information from. They 
were trying to get me to sign up to a pension 
(www.advisorynetwork.co.uk).” 


On 28 June 2019 the Commissioner advised CPSAL that, in light of the 
content of some of the complaints received which suggested that 
CPSAL had contacted individuals in relation to pension schemes, her 
investigation would now focus specifically on potential contraventions 
of regulation 21B PECR. 


On 8 July 2019 the Commissioner requested that CPSAL provides Call 
Dialler Records (“CDRs”) for calls made specifically relating to 


pensions. 


On 29 July 2019 CPSAL provided a spreadsheet in response which 
indicated that there had been a total of 527,221 agent handled calls 
made between 11 January 2019 and 30 April 2019. The Commissioner 
independently filtered out those calls which lasted for ‘zero seconds’ 
(i.e. those which had not connected to a subscriber) and found that 
106,987 calls remained. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 


23. 


24. 


25. 


26. 


27. 


28. 


29, 
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The Commissioner has considered whether those facts constitute a 


contravention of regulation 21B PECR by CPSAL and, if so, whether the 


conditions of section 55A DPA are satisfied. 
The contravention 


The Commissioner finds that CPSAL has contravened regulation 21B of 
PECR. 


The Commissioner finds that the contravention was as follows: 


The Privacy and Electronic Communications (Amendment) (No. 2) 
Regulations 2018, which came into force on 9 January 2019, amended 
PECR to insert Regulation 21B which restricts calls made for the 
purposes of direct marketing in relation to occupational pension 


schemes or personal pension schemes. 


The calls made by CPSAL constitute ‘direct marketing in relation to 
occupational pension schemes or personal pension schemes’ within the 
definition of regulation 21B(5)(b) PECR. Specifically, Regulation 
21B(5)(b)(iii) includes “the offer of any advice or other service to 
enable the assessment of the performance of an occupational pension 
scheme or a personal pension scheme (including its performance in 


comparison with other forms of investment)”. 


To engage in such calls it is a requirement of regulation 21B PECR that 
the caller be an “authorised person or a person who is the trustee or 
manager of an occupational pension scheme or a personal pension 


scheme”, 


Regulation 21B(5)(a) PECR states that “authorised person” has the 


meaning given in Section 31 of the Financial Services and Markets Act 


30. 


31. 


32. 


33. 


34. 


35. 
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2000 (“FSMA”). Section 31(1) FSMA lists the categories of persons 
who would constitute “authorised persons”. CPSAL has previously 
advised the Commissioner that it is an ‘Appointed Representative - 
Introducer’ (“IAR”), and believes it is therefore able to make calls 


relating to pension schemes. IARs are not included in the list of 


categories of “authorised persons” at Section 31(1) FSMA. 


Furthermore, the Commissioner notes that although there is evidence 
that CPSAL were engaging in direct marketing calls relating to pensions 
as early as 11 January 2019, it did not register as an IAR with the 
Financial Conduct Authority until 12 February 2019. 


In any event, whilst it is accepted that CPSAL was previously registered 
as an IAR for a period (its registration apparently ending as of 19 
August 2020), it did not at any time hold ‘Authorised’ status on the FCA 


Register. 


The Commissioner is therefore satisfied that CPSAL is not, and was not 
at the material time, an “authorised person” for the purposes of 
regulation 21B PECR. 


The Commissioner is also satisfied that CPSAL, which has no company 
website and presents its ‘nature of business’ on Companies House as 
‘Other service activities not elsewhere classified’, is not a trustee or 
manager of an occupational pension scheme or a personal pension 


scheme. 


Therefore, neither paragraphs 2 or 3 of regulation 21B apply, and 
CPSAL cannot lawfully make direct marketing calls in relation to 


occupational pension schemes or personal pension schemes. 


Even if CPSAL were an an “authorised person” or a “person who is the 


trustee or manager of an occupational pension scheme or a personal 
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pension scheme”, the Commissioner is satisfied that it neither had the 


consent of those who it called, nor an existing customer relationship 
with them, as required by regulation 21B(2)(b) or (3)(b). 


Between 11 January 2019 and 30 April 2019, CPSAL used a public 
electronic communications service to make 106,987 unsolicited calls for 
the purposes of direct marketing in relation to occupational pension 
schemes or personal pension schemes contrary to regulation 21B of 
PECR. 


The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 
Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 

above was serious. This is because between 11 January 2019 and 30 
April 2019 there were 106,987 unsolicited direct marketing calls made 
to subscribers in relation to occupational pension schemes or personal 
pension schemes by an organisation not lawfully authorised to carry 
out such activities. This represents a significant intrusion into the 


privacy of the recipients of such calls. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A (1) DPA is met. 


Deliberate or negligent contraventions 


The Commissioner has considered whether the contravention identified 


above was deliberate. 
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The Commissioner considers that, in this case, CPSAL did not 


deliberately contravene regulation 21B PECR. 


The Commissioner has gone on to consider whether the contravention 


identified above was negligent. 


She has considered whether CPSAL knew or ought reasonably to have 
known that there was a risk that these contraventions would occur. 

She is satisfied that this condition is met, not least because the issue of 
unsolicited calls in relation to occupational pension schemes or 
personal pension schemes has been widely publicised by the media as 
being a problem, so much so that it prompted recent legislative change 
to prohibit the making of such calls unless certain conditions are met. 
It is reasonable to suppose that any organisation wishing to carry out 
such activities should, and indeed must, be aware of its responsibilities 


in this area. 


The Commissioner has published detailed guidance on her website for 
those carrying out direct marketing calls for the purposes of pension 
schemes, explaining the strict criteria under which such calls can be 
made. This guidance explains such calls must not be made in relation 
to pension schemes unless the person calling is a trustee or manager 
of a pension scheme or a is firm authorised by the Financial Conduct 
Authority, and the individual being called has specifically consented to 


such calls or has a defined existing client relationship. 


Furthermore, the Commissioner notes that one of the directors of 
CPSAL had previously been a director of a company which had been 
subject to regulatory action by the Commissioner for unsolicited direct 
marketing activities. This further supports the Commissioner's view 


that CPSAL had at least one director who should have been acutely 
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cognisant to the need to act in compliance of the law. 


Secondly, the Commissioner has gone on to consider whether CPSAL 
failed to take reasonable steps to prevent the contraventions. Again, 
she is satisfied that this condition is met. Despite claiming to have 
‘diligently tracked’ all guidance on the lead up to the introduction of 
regulation 21B, it appears that CPSAL completely failed to recognise 
that not being an “authorised” entity, it could not make such calls in 
any event. The Commissioner is of the view that if CPSAL had 
familiarised itself with the relevant legislation and clear updated 
Government and ICO guidance it would have realised that it could not 
lawfully make unsolicited direct marketing calls for the purposes of 
pension schemes. Furthermore, there is no evidence that CPSAL 
sought to take independent legal advice, or to request advice from the 
Commissioner, prior to engaging in its direct marketing campaign. 
CPSAL have claimed that it became an IAR specifically to comply with 
regulation 21B, however the Commissioner is not persuaded by this, 
given that it did not become and IAR until a month after it had already 
started making such calls, and since an IAR is not authorised to make 


such calls in any event. 


Beyond this, whilst evidence provided by CPSAL suggests that some 
steps were taken in an effort to ensure that its data provider obtained 
valid consent for the purposes of direct marketing calls, from the two 
websites which CPSAL now say such consents were obtained from, it is 
apparent to the Commissioner that those consents cannot be said to 
have been freely given or specific and so would not constitute valid 


consent in any event. 
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The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met 


The Commissioner's decision to issue a monetary penalt 


The Commissioner has also taken into account the following 


aggravating features of this case: 


Pension calls, in particular, can lead to high levels of financial 
detriment and/or emotional stress. It is for this reason that the 


restriction on such calls was introduced. 


The purpose of these calls was to generate leads for a particular 
financial services provider / intermediary. The making of calls of this 
nature will always be for financial gain as the company will profit from 


any business resulting from the calls. 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A (1) DPA have been met in this case. She is 
also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out her preliminary thinking. In reaching her final 
view, the Commissioner has taken into account the representations 

made by CPSAL on this matter. 


The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 
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The Commissioner has considered whether, in the circumstances, she 


should exercise her discretion so as to issue a monetary penalty. 


The Commissioner has considered the likely impact of a monetary 
penalty on CPSAL. She has decided on the information that is available 
to her, that CPSAL has access to sufficient financial resources to pay 
the proposed monetary penalty without causing undue financial 


hardship. 


The Commissioner's underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The making of 
unsolicited direct marketing calls, particularly in relation to pension 
schemes, is a matter of significant public and parliamentary concern. A 
monetary penalty in this case should act as a general encouragement 
towards compliance with the law, or at least as a deterrent against 
non-compliance, on the part of all persons running businesses currently 
engaging in these practices. This is an opportunity to reinforce the 
need for businesses to ensure that they meet the strict criteria to 
engage in such activities and are only telephoning consumers who want 


to receive these calls. 


For these reasons, the Commissioner has decided to issue a monetary 


penalty in this case. 


The amount of the penalty 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £130,000 (one hundred and thirty 
thousand pounds) is reasonable and proportionate given the 
particular facts of the case and the underlying objective in imposing the 


penalty. 
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Conclusion 


The monetary penalty must be paid to the Commissioner's office by 
BACS transfer or cheque by 7 October 2020 at the latest. The 
monetary penalty is not kept by the Commissioner but will be paid into 
the Consolidated Fund which is the Government’s general bank account 
at the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 
6 October 2020 the Commissioner will reduce the monetary penalty 
by 20% to £104,000 (one hundred and four thousand pounds). 

However, you should be aware that the early payment discount is not 


available if you decide to exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 


against: 
(a) the imposition of the monetary penalty 
and/or; 
(b) the amount of the penalty specified in the monetary penalty 


notice. 


Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 


unless: 
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e the period specified within the notice within which a monetary 


penalty must be paid has expired and all or any of the monetary 


penalty has not been paid; 


e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


e the period for appealing against the monetary penalty and any 


variation of it has expired. 


64. In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as 
an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 


Dated the 4t" day of September 2020. 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 


SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 55B(5) of the Data Protection Act 1998 gives any person upon 
whom a monetary penalty notice has been served a right of appeal to 
the First-tier Tribunal (Information Rights) (the ‘Tribunal’) against the 


notice. 
2; If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of discretion by 
the Commissioner, that she ought to have exercised her 


discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3; You may bring an appeal by serving a notice of appeal on the Tribunal 


at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 
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LE1 8DJ 


Telephone: 0300 123 4504 
Email: grc@justice.gov.uk 


The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 


If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 


rule. 


The notice of appeal should state:- 


a) 


b) 


C) 


d) 


e) 


f) 


g) 


your name and address/name and address of your representative 


(if any); 


an address where documents may be sent or delivered to you; 


the name and address of the Information Commissioner; 


details of the decision to which the proceedings relate; 


the result that you are seeking; 


the grounds on which you rely; 


you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 
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h) if you have exceeded the time limit mentioned above the notice 


of appeal must include a request for an extension of time and the 


reason why the notice of appeal was not provided in time. 


Before deciding whether or not to appeal you may wish to consult your 
solicitor or another adviser. At the hearing of an appeal a party may 
conduct his case himself or may be represented by any person whom 


he may appoint for that purpose. 


The statutory provisions concerning appeals to the First-tier Tribunal 
(Information Rights) are contained in section 55B(5) of, and Schedule 
6 to, the Data Protection Act 1998, and Tribunal Procedure (First-tier 
Tribunal) (General Regulatory Chamber) Rules 2009 (Statutory 
Instrument 2009 No. 1976 (L.20)). 
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